Actually, the iPhone has plenty of security loopholes one can exploit. Yes, even on a device that hasn't been jailbroken. In fact, because the iPhone is so popular, there's a plethora of viruses/malware targeted at it, whereas Android is a younger platform and commands a smaller market share: same deal with Windows and OS X--Mactards think their platform is secure only because there's less malware targeted at them, and more at Windows which is used by real people rather than pretentious hippies. Then again, Apple's precious Safari (yes, the iPhone version too) has been hacked and hacked and broken in like five minutes. Google's browser, Chrome? The only browser that survived Pwn2Own 2010: draw your own conclusions.
With Android, when you install an app, you'll be told what permissions it requires. Read those, and if you see anything that requests what you think it shouldn't, don't install. Simples.
(Even apps that require root will request a #su permission so you can manually choose to let, or not let, it access your system files. It's pretty hard for an app to do anything without your consent.)